Customer using the Services (the "Customer") and LINE Plus Corporation (the "Company") enter into this Personal Information Processing Entrustment Agreement (this "Agreement") on the following terms with respect to the Customer's entrustment to the Company of the Personal Information processing activities necessary for the use of “ActEngine” and related services provided by the Company (collectively, the "Services"). This Agreement forms part of the Service Terms entered into or applicable between the Customer and the Company, and applies automatically when the Customer applies for the Services or uses the administrator console or similar tools. This Agreement is incorporated as part of the Service Terms without any separate signature or seal, and the Customer is deemed to have agreed to it by applying for or using the Services. Except as otherwise defined herein, capitalized terms used in this Agreement have the meanings given to them in the Service Terms.
Article 1 (Purpose)
The purpose of this Agreement is to set out the matters necessary for the safe processing of Personal Information, whereby the Customer entrusts Personal Information processing activities to the Company in connection with the Customer's use of the Services, and the Company accepts such entrustment.
Article 2 (Definitions)
(1) Except as otherwise defined in this Agreement or where the context clearly requires otherwise, each term and expression used in this Agreement has the meaning set out below:
"Personal Information" means information relating to a living individual that falls under any of the following:
information that identifies a specific individual by their name, resident registration number, image, or the like;
information that, even if it alone cannot identify a specific individual, can be readily combined with other information to identify that individual (in this case, whether the information can be readily combined shall be assessed by reasonably taking into account the time, cost, technology, and other factors required to identify the individual, including the likelihood of obtaining such other information; and
information derived from the information described in item a or b above that has been pseudonymized, by deleting part of the Personal Information, or by replacing part or all of it, among other methods, so that a specific individual cannot be identified without additional information, and that cannot be used to identify a specific individual without the use or combination of such additional information required to restore it to its original state.
"Personal Information Controller" means a public institution, legal entity, organization, individual, or the like that processes Personal Information, whether directly or through another person in order to operate Personal Information files for business purposes or otherwise specified under Personal Information Protection Laws and Regulations.
"Persons Handling Personal Information" means a person who processes Personal Information under the direction and supervision of a Personal Information controller, including officers and employees, dispatched workers, and part-time workers.
"Data Subject" means an individual who is identifiable by the information being processed and who is the subject of that information.
"Processing" means the collection, generation, linkage, interconnection, recording, storage, retention, alteration, editing, retrieval, output, correction, recovery, use, provision, disclosure, and destruction of Personal Information, as well as other similar activities.
(2) References in this Agreement to statutes, decrees, rules, public notices, and the like (collectively, "Laws and Regulations") mean the Laws and Regulations in effect as of the date of this Agreement, and, where subsequently amended or replaced, the Laws and Regulations as so amended or replaced.
Article 3 (Purpose and Scope of the Entrusted Work)
In accordance with this Agreement, the Company shall process the Personal Information contained in the data that the Customer inputs, uploads, transmits, or submits to, or interconnects with, the Company in the course of using the Services, or that the Company is granted access rights to and processes, solely to the extent necessary to provide the "Services" as defined in the Service Terms.
Article 4 (Term of the Entrusted Work)
The term of the Personal Information processing work under this Agreement shall run from the time the Customer applies for, accesses, or uses the Services under the Service Terms or otherwise until the service use agreement under the Service Terms or otherwise terminates. Provided that, even after termination of the service use agreement, the relevant provisions shall continue to apply, to the extent necessary for the return, deletion, destruction, backup retention, or statutory retention of the Customer's Personal Information, for dispute response, or for the performance of obligations under this Agreement, until such processing is completed.
Article 5 (Restrictions on Sub-Entrustment)
(1) The Customer agrees that the Company may sub-entrust all or part of the Personal Information processing work under this Agreement, to the extent necessary for the Company to perform its obligations under this Agreement, to any sub-processor that the Company has disclosed in advance via a separate web page or by other reasonable means determined by the Company.
(2) Where the Company changes or adds a sub-processor under this Article, the Company shall notify the Customer in advance, or disclose, the information that the Company can reasonably make available, such as the name of the changed or added sub-processor and the scope of the sub-entrusted work, in accordance with Article 5(1) above.
(3) The Customer may object to such change or addition of a sub-processor within 15 days from the date on which the Company notifies or discloses the same to the Customer under Article 5(2) of this Article; if the Customer does not object within that period, the Customer is deemed to have consented to the addition or change of the sub-processor. In such case, the parties shall consult with each other in good faith to resolve the grounds for the objection.
(4) In connection with sub-entrustment under this Article, the Company shall enter into an agreement with the sub-processor in writing, by electronic document, or by other legally valid means. The Company shall impose on the sub-processor Personal Information protection obligations that are substantially equivalent to those borne by the Company under this Agreement.
Article 6 (Measures to Ensure the Safety of Personal Information)
The Company shall implement the administrative, technical, and physical safeguards necessary to ensure the safety of Personal Information, in accordance with the Personal Information protection Laws and Regulations applicable to the Company, in order to prevent the loss, theft, leakage, forgery, alteration, damage, or unauthorized access of the Customer's Personal Information. Where the Personal Information protection Laws and Regulations of a particular country or industry-specific regulations apply to the Customer, the Company shall reasonably cooperate, with respect to matters relating to the provision of the Services and within the Company's control, so that the Customer can perform its obligations under such Laws and Regulations. Provided that, where such matters exceed the Company's standard security measures or the Services, the Customer and the Company shall consult separately.
Article 7 (Restrictions on the Processing of Personal Information)
(1) The Company shall process the Customer's Personal Information only to the extent necessary to provide the Services and perform its obligations under the Service Terms and this Agreement and shall not use the Personal Information beyond the scope of the purpose of performing the entrusted work, or provide or disclose it to any third party.
(2) Except where prohibited or impracticable under the relevant Laws and Regulations or a court order, the Company shall, upon termination of the service use agreement or upon the Customer's request for deletion, delete, destroy, or anonymize the Personal Information held in connection with the entrusted work, in accordance with its separate destruction policy and the Personal Information protection Laws and Regulations.
Article 8 (Management and Supervision of the Entrustee, etc.)
(1) In connection with the entrustment of the processing of the Customer's Personal Information, the Customer may request the Company to provide a reasonable scope of materials or written confirmation in order to perform the management and supervision obligations required under the Personal Information protection Laws and Regulations.
(2) Upon the Customer's reasonable request, the Company may cooperate with the Customer's performance of its management and supervision obligations by providing relevant security certifications, audit reports, security- and privacy-related materials, self-assessment results, or comparable materials, or by responding to written inquiries.
(3) Where the materials referred to in Article 8(2) alone do not enable the Customer to reasonably ascertain whether there has been any material non-compliance in the entrusted processing of the Customer's Personal Information, the Customer and the Company shall consult in advance regarding the matters requiring further confirmation, the scope of materials that can be provided, the manner of confirmation, the schedule, and the allocation of costs. Any such further confirmation shall be carried out in a manner that does not impair the Company's normal business operations, its security policies, trade secrets, system stability, or the information and rights of other customers or third parties.
(4) Access to the Company's systems or operating environment, on-site audits, or comparable procedures may be conducted only where there is a material security incident directly related to the Customer's Personal Information, a request from a relevant authority, a requirement under the relevant Laws and Regulations, or another reasonable ground on which whether there has been material non-compliance cannot be ascertained from the materials referred to in Article 8(2) alone, and only when the Customer and the Company have agreed in advance and in writing on the purpose, scope, manner, schedule, security requirements, and allocation of costs.
(5) Where the confirmation under this Article reveals any material non-compliance with this Agreement or the Personal Information protection Laws and Regulations in connection with the processing of the Customer's Personal Information, the Company shall take reasonably necessary measures, taking into account the nature and level of risk of the matter, its impact on the Customer's Personal Information, technical feasibility, service stability, and the impact on other customers. Upon the Customer's reasonable request, the Company may provide information on the progress or completion of such measures.
Article 9 (Measures in the Event of a Personal Information Breach)
In the event of a leakage of Personal Information processed by the Company, the Company shall report to the Customer the categories of Personal Information leaked, the time and circumstances of the leakage, the measures necessary to minimize the harm caused by the leakage, and other related matters and shall cooperate with and assist the Customer in responding to such leakage..
Article 10 (Training and Confidentiality for Persons Handling Personal Information)
(1) The Company shall ensure that Persons Handling Personal Information who access or process the Customer's Personal Information, including officers and employees, contract workers, and partner companies, comply with the internal policies and procedures relating to Personal Information protection, information security, confidentiality, and the processing of the Customer's Personal Information; shall grant access rights to Personal Information only to the minimum number of persons; and shall provide appropriate training for Persons Handling Personal Information.
(2) Where the Customer reasonably requests confirmation of whether the Company has conducted such training in order to perform its obligations under the Personal Information protection Laws and Regulations, the Company may provide materials to the extent that it can reasonably make them available.
Article 11 (Assistance with Data Subjects' Rights Requests)
The Customer shall be responsible for responding to Data Subjects' requests to exercise their rights with respect to Personal Information, including access, correction and deletion, suspension of processing, withdrawal of consent, and other rights. Where the Company processes Personal Information on behalf of the Customer, the Company may forward the requests to the Customer or direct the Data Subject to submit the request directly to the Customer. The Company shall reasonably assist the Customer in processing requests for access to, correction or deletion of, or suspension of the processing of Personal Information. Except where the Company is required to respond directly as an independent Personal Information Controller, the Company shall handle such requests on its own.
Article 12 (Indemnification)
(1) As between the Customer and the Company, matters relating to the exemption from liability toward, and the indemnification of, users shall be governed by the terms and conditions set out in the Service Terms.
(2) The Company shall be liable for a sub-processor's processing of the Customer's Personal Information only within the scope of the obligations borne by the Company under this Agreement. Provided that, where damage arises from the sub-processor's willful misconduct or gross negligence and the Company has exercised due care in the selection and supervision of the sub-processor, the Company's liability may be exempted or mitigated.
Article 13 (Lawful Basis for Processing Personal Information, etc.)
(1) In connection with this Agreement, the Customer, acting in the capacity of a Personal Information Controller, entruster, or equivalent position, shall, at its own responsibility, carry out all necessary measures required under the Personal Information protection Laws and Regulations with respect to the collection and use, provision to third parties, entrustment of processing, and other processing of the Customer's Personal Information, including obtaining and maintaining lawful consent, providing notice, establishing a contractual basis, and securing a legitimate basis for processing. Where a Data Subject withdraws consent to the processing of Personal Information or requests the suspension of processing, among other things, the Customer shall notify the Company without delay of the matters necessary to cease the processing of the relevant Personal Information.
(2) Except as otherwise agreed separately between the Customer and the Company, the Customer shall take reasonable measures to ensure that unique identifying information (such as resident registration numbers, passport numbers, driver's license numbers, and alien registration numbers), sensitive information, payment card information, medical information, children's Personal Information, and other high-risk Personal Information are not included in the course of using the Services. Where the Customer determines that the processing of such information is necessary for the purpose of using the Services, the Customer shall consult with the Company in advance regarding the protective measures required.
(3) The Customer acknowledges that, in the course of the provision of the Services, the Customer's Personal Information may be transferred to, stored in, hosted on, accessed from or otherwise processed through overseas infrastructure, sub-processor, AI models or AI service providers, technical support personnel, affiliated companies, or third parties necessary for the operation of the Services, and shall, at its own responsibility, carry out the measures required in connection with cross-border transfers under the Personal Information protection Laws and Regulations, including obtaining and maintaining lawful consent, providing notice, establishing a contractual basis, and securing a legitimate basis for processing.
(4) The Company may provide or disclose the information that it can reasonably make available, such as the sub-processor, the countries to which information is transferred, and the scope of the Personal Information transferred, so that the Customer can perform its obligations under Article 13(1) through (3).
Article 14 (Effect of the Agreement, etc.)
(1) This Agreement constitutes the parties' complete agreement as the final written expression of their respective rights and obligations in connection with the entrustment of Personal Information processing, and supersedes all prior agreements or arrangements between the Customer and the Company relating to the subject matter of this Agreement. In addition, in the event of any conflict between the provisions of this Agreement and the provisions of the Service Terms, this Agreement shall prevail over the Service Terms with respect to matters relating to the entrustment of Personal Information processing.
(2) Provided that, where requested by the Customer or where the Company deems it necessary, the Company may separately enter into an agreement having the same or substantially equivalent content as this Agreement.
ANNEX1 - THAILAND SPECIFIC TERMS
These Annex 1 - Thailand Specific Terms shall form and constitute part of the Agreement. The Company and the Customer are hereinafter each referred to as a “Party” and collectively as the “Parties”.
WHEREAS, the Company and the Customer agree to execute these Annex 1 - Thailand Specific Terms in order to ensure compliance with Thailand’s Personal Data Protection Act B.E. 2562 (2019), including any rules, regulations, notifications, directives and/or guidelines issued by virtue thereof, as may be amended, supplemented or replaced from time to time (collectively, the “Thai PDPA”); and
NOW, THEREFORE, the Parties hereto agree as follows:
Definition. The definitions in relation to the processing of Personal Information are as follows:
“Personal Information Processor” means person or a juristic person who operates in relation to the processing of the Personal Information pursuant to the orders given by or on behalf of a Personal Information Controller, whereby such person or juristic person is not the Personal Information Controller.
Management and Supervision of the Entrustee. Paragraph (2) and (3) under Article 8 (Management and Supervision of the Entrustee, etc.) shall not be applicable for Thailand.
Personal Information Leak or Personal Information Breach.
The definition of the Personal Information leak or breach specified in Article 8-2 of the Agreement shall have the same meaning of the personal data breach incident as specified in Thai PDPA, which refers to any breach of security that leads to loss, or unauthorized or unlawful access, use, change, alteration, or disclosure of personal data, whether such breach occurs intentionally, wilfully, by negligence, without authorization or unlawfully, computer crime, cyber threat, any mistake, accident, or any other reasons (hereinafter called “Personal Information Breach”)
In the event where there is a Personal Information Breach as mentioned in Article 8-2, the Company shall report to the Customer without undue delay after becoming aware of the incident, unless otherwise specified under Personal Information protection Laws and Regulations in relevant jurisdictions. The information contained in the Personal Information Breach notification to the Customer shall consist of those required under Thai PDPA.
Cross-Border Transfer of Personal Information.
“Cross-border Transfer of Personal Information” means sending or transferring Personal Information from Thailand to another country by the sender or transferor, regardless of whether the sending or transferring of Personal Information is carried out by physical means, or by means of computer system or network system, to the recipient. This does not include the sending and receiving of Personal Information in an intermediary manner between the computer system or the network system or data storage (data transit), whether temporary or permanently, that is inaccessible for any persons other than the sender of such Personal Information, who is a Personal Information Controller or Personal Information Processor, and personnel, staff, or employees of such Personal Information Controller or Personal Information Processor. For example, the sending of data via a network system located in a foreign country or the sending of data via cloud computing service providers' system, where the Personal Information is inaccessible for any persons, except for the Personal Information Controller or Personal Information Processor who are senders, and their personnel, staff, or employees, due to technical measures or supporting legal conditions.
In the case of Cross-border Transfer of Personal Information, the Parties agreed and shall comply with Module Two (Controller to Processor) of the Standard Contractual Clauses for the Transfer of Personal Information to Third Countries as issued under Article 46(1), Article 46(2)(c), and Article 28(7) of Regulation (EU) 2016/679 of the European Union, the General Data Protection Regulation (“EU SCCs”).
For the avoidance of doubt, the Parties acknowledge and agree that, for the purposes of the EU SCCs, the Customer acts as the "data controller" and "data exporter", and the Company acts as the "data processor" and "data importer". References in the EU SCCs to a "data controller" shall be construed as references to a Personal Information Controller, and references to a "data processor" shall be construed as references to a Personal Information Processor, as defined in this Agreement.
If any provision of these Annex 1 - Thailand Specific Terms amends the EU SCCs in any way which is not permitted under the Thai PDPA, such amendments(s) will be void and the equivalent provision of the EU SCCs, or the Thai PDPA in case there is no such equivalent provision in the EU SCCs, shall apply.
If the EU SCCs or the Annex 1 - Thailand Specific Terms are deemed invalid by the Personal Data Protection Committee of Thailand (“PDPC”) or other competent supervisory authorities (collectively with the PDPC, the “Supervisory Authority”), or if the Supervisory Authority imposes additional rules, requirements or restrictions regarding the Cross-border Transfer of Personal Information, the Parties agree to collaborate and coordinate with each other in good faith to modify the EU SCCs and/or the Annex 1 - Thailand Specific Terms, as the case may be, or find an alternative approach with respect to the Cross-border Transfer of Personal Information to ensure that any such Cross-border Transfer of Personal Information complies with the Thai PDPA.
In the event that the European Commission or other relevant Supervisory Authority issues new, updated or replacement of the EU SCCs, or the PDPC issues a new, updated or replacement of the rules, regulations or notifications regarding the Restricted Transfer, which affect the terms of these Thailand Specific Terms, the Parties agree to collaborate and coordinate with each other in good faith to amend these Annex 1 - Thailand Specific Terms as appropriate and necessary to ensure that the Restricted Transfer remains in compliance with the Thai PDPA.
If the meaning of these Annex 1 - Thailand Specific Terms is unclear or there is more than one meaning, the meaning which most closely aligns with the Thai PDPA shall apply.
For the EU SCCs, the Parties agree on the following:
Any reference to the “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the Personal Information in the EU SCCs are all replaced by “Thai PDPA”, unless the context does not allow such substitution, and shall be interpreted to mean references to the Thai PDPA as amended or superseded from time to time.
Any reference to specific Article(s) of “Regulation (EU) 2016/679” in EU SCCs are replaced with the equivalent Article, Clause or Section of the Thai PDPA, unless the context does not allow such substitution. Any reference to legislation (or specific provisions of legislation) in EU SCCs means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after theses Annex 1 - Thailand Specific Terms have been entered into.
References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State”, and “EU or Member State” in EU SCCs are all replaced with “Thailand”.
References to the “competent supervisory authority” and “supervisory authority” in EU SCCs are replaced with the “the Office of Personal Data Protection Committee of Thailand”, “Personal Data Protection Committee of Thailand” or “any competent authority applicable to the subject matter”.
Clause 7 (Docking Clause) shall not apply.
References to “technical and organizational measures to ensure the security of the data” in Clause 8.6, they must also comply with the Notification of the Personal Data Protection Committee on the security measures of Personal Information Controller issued under Section 37(1) of the Thai PDPA including any other amendments thereof.
The term “sensitive data” referenced in the EU SCCs shall additionally include Personal Information revealing cult and disability or any data which may affect the Data Subject in the same manner as prescribed by the Personal Data Protection Committee of Thailand, in accordance with Section 26 of the Thai PDPA.
The term “personal data breach” referenced in Clause 8.6(a) shall have the same meaning ascribed to it under the Thai PDPA; and the personal data breach notification must also comply with the Notification of the Personal Data Protection Committee on the personal data breach notification issued under Section 37(4) of the Thai PDPA including any other amendments thereof.
For Clause 9(a), Option 2 shall apply; sub-processor changes require 15 business days’ notice.
Clause 10 is without prejudice to the Personal Information Controller’s obligations to fulfil Data Subject rights requests under the Thai PDPA, including access, rectification, and erasure. The transferring Party shall facilitate such requests.
Clause 13(a) and Part C of Annex I shall not apply.
With regard to Clause 17, the governing law is as specified in the Agreement.
With regard to Clause 18, any dispute arising from the EU SCCs or these Thailand Specific Terms shall be resolved in accordance with the Agreement.
The data importer shall not disclose or transfer Personal Information obtained in accordance with the Agreement to a third party located in a foreign country (onwards transfers) unless such transfer complies with the Thai PDPA’s provisions regarding cross-border transfer. Where the Thai PDPA does not apply to the data importer, it shall not carry out such transfers unless the third party agrees to implement appropriate safeguards or enter into the contract clauses equivalent to those required under the Thai PDPA for cross-border transfer, or agrees to be bound by clauses equivalent to this Agreement, including Annex 1 - Thailand Specific Terms.
In addition to those provisions pertaining to the data subject’s rights set out in Clause 10, and notwithstanding those provisions pertaining to onwards transfers set out in Clause 8.8, the Data Subject shall have a right to request a cancellation of the transfers of his/her Personal Information, and the right to request a cancellation of the processing of Personal Information that is beyond the specific purpose(s) of processing set out and agreed under the Agreement. The data importer shall fulfil its obligations and/or provide notification and assistance to the transferring party, as applicable and necessary, with respect to the said requests in the same manner as set out for the requests and exercise of the other data subject’s rights in the EU SCCs.
In addition to these Annex 1 - Thailand Specific Terms and the EU SCCs setting out a clause pertaining to transparency (if any), the Party acting as a Personal Information Controller shall ensure that it has, regardless of whether the Personal Information Controller is subject to the Thai PDPA, an appropriate and effective means to inform Data Subjects regarding the Cross-Border Transfer of Personal Information of their Personal Information with (i) the description of Personal Information; (ii) the identity and contact details of the receiving Party; and (iii) any other information as required by Section 23 of the Thai PDPA, where applicable.
Annexes referred to in the EU SCCs shall be as follows:
Annex I.A. The data exporter is the Customer, details of which are as per those registered with the Company. The data importer is the Company, details of which are specified on the Company’s website, Service Agreement(s), and other places available in the Company’s environment.
Activities relevant to the data transferred are as specified in the Service Agreement and Article 3 of this Agreement.
Annex I.B.
Categories of data subjects whose personal data is transferred, Categories of personal data transferred, nature of the processing, purposes of the data transfers, and retention period, are as specified in the Service Agreement and Article 3 of this Agreement.
The frequency of the transfer: The data is transferred on a continuous basis to provide Services.
No sensitive personal data/information is intended to be transferred under this Agreement.
The details relating to transfer involving (sub-) processors are the same as those specified above.
Other details are as specified in the Service Agreement, Article 3, Article 5, and Article 7 of this Agreement.
Annex II (Technical and Organizational Measures). The Security Measures shall be in accordance with Thai PDPA and at least comply with Annex II: SCHEDULE OF SECURITY MEASURES STANDARDS to the EU SCCs.
Annex III (List of Sub-Processors). The list of Sub-Processors is as listed in this link, which may be updated from time to time.
Defined Terms. All capitalized terms not otherwise defined herein shall have those meanings ascribed to them in the Agreement and Personal Information protection Laws and Regulations.
Prevalence. These Annex 1 - Thailand Specific Terms shall be interpreted in a manner that is consistent with the Thai PDPA so that it fulfils the Parties’ obligation to provide the appropriate safeguards thereunder. Unless the applicable laws specified otherwise, if there is any inconsistency or conflict between this Country Addendum and the main body of the Agreement, this Country Addendum shall apply for processing activities relating to Thailand.